CVE-2020-24401 — Incorrect permissions following the deletion of a user role or deactivation of a user
Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect authorization vulnerability. A user can still access resources provisioned under their old role aft…
Published: 2020-11-09 · CVSS: 6.5 · CVSS 3.1
Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect authorization vulnerability. A user can still access resources provisioned under their old role after an administrator removes the role or disables the user's account.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7